Ya, you might be on to something. I just encountered a discourse instance in the wild that has SSO enabled but it is also showing the “Email is disabled” banner and I’m not even logged in.
With SSO they won’t have to worry about password resets, so besides email notifications that people won’t receive I’m not sure why we HAVE to show this banner to everyone if SSO is enabled.
Maybe we at least update it to not show the banner if sso is enabled and you aren’t logged in?